You can’t protect everything, there’s no point in protecting everything. If you try to protect everything you actually end up protecting nothing. There are a lot of frameworks that can help us understand how we should be protecting our security assets, but they don’t really do a great job of helping identify what those assets really are.